Cross-Site Scripting Vulnerability in The Post Grid by WordPress
CVE-2026-94680

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
The Post Grid
Vendor
CVE Published:
23 September 2026

What is CVE-2026-94680?

A Cross-Site Scripting (XSS) vulnerability exists in The Post Grid plugin version 7.9.5 for WordPress. This flaw allows attackers to inject malicious scripts into web pages viewed by other users. Consequently, if exploited, it can lead to various security risks such as session hijacking, defacement, and the distribution of malware. It is imperative for users of affected versions to apply the necessary patches to ensure their WordPress environment remains secure.

Affected Version(s)

The Post Grid <= 7.9.5

References

https://patchstack.com/database/wordpress/plugin/the-post...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Intrudify | Patchstack Bug Bounty Program
.